CVE-2026-111923 in Fleet
Summary
by MITRE • 10/17/2026
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The identified vulnerability resides within the Apple Mobile Device Management (MDM) enrollment subsystem of Fleet software prior to version 4.89.0. This flaw is classified as an unbounded recursive function call during the parsing of binary property list payloads submitted by clients attempting to enroll with the server. The core technical issue stems from insufficient validation and depth-limiting mechanisms when processing nested data structures within the plist format. When a specifically crafted binary plist payload, approximately 150 bytes in size, is transmitted to the enrollment endpoints, it triggers an exponential allocation pattern or infinite recursion loop within the parser logic. This behavior causes the server process to rapidly consume available system resources, leading to a denial of service condition where the CPU and memory are exhausted, effectively crashing the Fleet application instance.
From a security classification perspective, this vulnerability aligns with CWE-675, which denotes operations on data with insufficiently bounded dimensions, specifically manifesting here as uncontrolled recursion depth. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates Denial of Service (DoS) attacks under the technique T1499, where an attacker disrupts service availability by exhausting computational resources rather than compromising confidentiality or integrity directly. The attack vector is particularly concerning because it allows unauthenticated actors to trigger the crash simply by interacting with standard enrollment endpoints that are often exposed on network interfaces for device management purposes.
The operational impact of this vulnerability is severe in production environments where Fleet manages large fleets of devices. A successful exploitation results in immediate service disruption, requiring manual intervention or automatic restarts to restore functionality. This not only halts ongoing MDM operations but also creates a window of opportunity for further attacks if the system recovers with compromised state or leaves logs that might reveal internal architecture details. Furthermore, repeated attempts can lead to resource starvation affecting other services running on the same host infrastructure, amplifying the blast radius beyond just the Fleet application itself.
To mitigate this risk, organizations must upgrade Fleet to version 4.89.0 or later, where the parsing logic has been hardened with proper recursion depth limits and input validation checks. Until an upgrade is feasible, network-level mitigations should be implemented. This includes restricting access to MDM enrollment endpoints via firewall rules to only trusted IP ranges associated with managed devices. Additionally, deploying Web Application Firewalls (WAF) or API gateways that can detect and block anomalous payload sizes or recursive patterns in plist submissions can provide a temporary layer of defense against exploitation attempts while the underlying software is being patched.